investigation report - petroleumstilsynet€¦ · investigation report report report title activity...
TRANSCRIPT
Investigation report Report Report title Activity number
Investigation of the incident in well 7132/2-1, unintentional disconnection of
the lower marine riser package (LMRP) on West Hercules, 16 January 2019
404008005
Security grading
Public
Not publicly available
Restricted
Confidential
Strictly confidential
Involved Team Approved by/date
T-F Irja Viste-Ollestad/29 April 2019
Members of the investigation team Investigation leader
Kristen Kjeldstad, Eigil Sørensen, Fredrik Dørum,
Linn Iren Vestly Bergh and Amir Gergerechi
Amir Gergerechi
2
Contents
SUMMARY ................................................................................................................................................................ 3 1 BACKGROUND INFORMATION .......................................................................................................................... 4
1.1 DESCRIPTION OF FACILITY AND ORGANISATION ............................................................................... 5 1.2 STATUS BEFORE THE INCIDENT .......................................................................................................... 5 1.3 EQUIPMENT INVOLVED ...................................................................................................................... 6 1.4 ABBREVIATIONS AND EXPLANATIONS ............................................................................................... 8
2 THE PSA’S INVESTIGATION ................................................................................................................................ 9 2.1 MANDATE FOR THE INVESTIGATION ................................................................................................. 9 2.2 LIMITATIONS ...................................................................................................................................... 9 2.3 INTERVIEWS, VERIFICATION ON THE FACILITY AND ASSESSMENT OF DOCUMENTS ........................ 9
3 COURSE OF EVENTS ........................................................................................................................................ 10 4 POTENTIAL OF THE INCIDENT ......................................................................................................................... 12
4.1 ACTUAL CONSEQUENCES ................................................................................................................. 12 4.2 POTENTIAL CONSEQUENCES ............................................................................................................ 12
5 DIRECT AND UNDERLYING CAUSES ................................................................................................................. 12 5.1 DIRECT CAUSES ................................................................................................................................ 12 5.2 UNDERLYING CAUSES ....................................................................................................................... 12
5.2.1 RISK MANAGEMENT ................................................................................... 13 5.2.2 COMPETENCE AND CAPACITY .................................................................... 13 5.2.3 PROCEDURES AND COMPLIANCE ............................................................... 14 5.2.4 MANAGEMENT OF CHANGE ....................... Feil! Bokmerke er ikke definert. 5.2.5 SEE-TO-IT DUTY .......................................................................................... 15
5.3 ORGANISATIONAL CHANGES, COST REDUCTIONS AND INCREASED EMPHASIS ON EFFICIENCY ..... 15 6 OBSERVATIONS ............................................................................................................................................... 16
6.1 NONCONFORMITIES ......................................................................................................................... 16 6.1.1 RISK MANAGEMENT ................................................................................... 16 6.1.2 COMPETENCE AND CAPACITY .................................................................... 17 6.1.3 PROCEDURES AND COMPLIANCE ............................................................... 17 6.1.4 MAINTENANCE ........................................................................................... 17 6.1.5 MANAGEMENT OF CHANGE ....................................................................... 18 6.1.6 SEE-TO-IT DUTY .......................................................................................... 18
7 BARRIER STATUS ............................................................................................................................................. 19 8 DISCUSSION OF UNCERTAINTIES .................................................................................................................... 19 9 ASSESSMENT OF THE PLAYER’S INVESTIGATION REPORT .............................................................................. 20 10 APPENDICES .................................................................................................................................................... 20
List of figures
FIGURE 1: THE SEMI-SUBMERSIBLE WEST HERCULES DRILLING FACILITY. (SOURCE: SEADRILL) ............................ 5 FIGURE 2: EXAMPLE OF A SUBSEA BOP AND LMRP. ............................................................................................... 6 FIGURE 3: THE GREEN CIRCLE IN THE DIAGRAM INDICATES THE SAFE WORKING AREA AND THE YELLOW ONE
SHOWS WHEN THE EDS INITIATES DISCONNECTION. ................................................................................... 7 FIGURE 4: OUTLINE OF THE ADS DISCONNECT MECHANISM WITH ALL FIGURE 5: OUTLINE OF ADS
ACTIVATION OF THE DISCONNECT MECHANISM. ........................................................................................ 7 FIGURE 6: THE ADS INSTALLED ON THE WEST HERCULES FLEXJOINT. FIGURE 7: THE ADS INSTALLED ON THE WEST HERCULES TEST BENCH. ................................................................. 7 FIGURE 8: ACTIVITY LOG AND LOSS OF FLUID. (SOURCE: SEADRILL) .................................................................... 10 FIGURE 9: IMAGES TAKEN BY ROV AFTER THE UNINTENTIONAL DISCONNECTION. (SOURCE: SEADRILL) ........... 11 FIGURE 10: THIS IMAGE OF AN EIGHT-INCH DRILL COLLAR ON DECK AFTER THE INCIDENT SHOWS DAMAGE
AFTER THE COLLAR WAS CRUSHED IN THE BSR. (SOURCE: SEADRILL) ....................................................... 11
3
SUMMARY
At 22.46 on 16 January 2019, the lower marine riser package (LMRP) was unintentionally
disconnected as the bottom hole assembly (BHA) passed down the blowout preventer (BOP).
Equinor is operator for well 7132/2-1 in the Barents Sea. Work on the well was conducted by
the West Hercules semi-submersible drilling facility operated and owned by Seadrill.
The incident occurred during preparations to drill the 12 ¼-inch section. Drilling of the 42-
and 17 ½-inch sections at the Gjøkåsen location had been completed. This involved drilling,
cementing and pressure testing of the most recently set casing string – 20-inch x 13 3/8-inch –
at a measured depth of 595 metres.
The sea was calm with 0.4 metres of heave and good weather conditions. The water depth at
the location is 293 metres. The blind shear ram (BSR) activated automatically, and liquid
(seawater) from the riser was drained (dumped) to the sea. Subsequent observations showed
that the BSR had failed to cut the drill string, which was struck in the BOP’s BSR.
A decision was taken by the Petroleum Safety Authority Norway (PSA) on 18 January 2019
to launch an investigation of the incident. The investigation team’s mandate included
clarifying the course of events and assessing direct and underlying causes with the emphasis
on human, technical and organisational (HTO) as well as operational conditions from a barrier
perspective. This mandate covered conditions up to the time of the incident.
No personal injuries or harmful discharges to the environment were caused by the incident.
The incident occurred while the well was secured with casing and a cement plug at the
bottom. No risk accordingly existed of discharges from the reservoir to the environment.
Had the same incident occurred at a later time, with hydrocarbons present, however, the
position could have been more demanding with environmentally harmful discharges from
formations in the 12 ¼- or 8 ½-inch sections.
The direct cause of the incident was a fault in the automatic disconnect system (ADS), which
issued a signal to disconnect the LMRP from the BOP.
Six nonconformities have been identified by the investigation. These relate to
- risk management
- competence and capacity
- procedures and compliance
- maintenance
- management of change (MOC)
- see-to-it duty.
No improvement points were identified.
4
1 BACKGROUND INFORMATION
At the time of the incident, West Hercules was drilling the Gjøkåsen wildcat for Equinor in
the Barents Sea.
The location and map have been taken from the application for consent to drill (Søknad om
samtykke til leteboring med West Hercules på Gjøkåsen 7132/2-1 PL 857).
The licence organisation for the 7132/2-1 wildcat in PL 857 was as follows.
Company Percentage
Equinor AS (operator) 40
Lundin Norway AS 20
Petoro AS 20
Aker BP AS 20
Objectives with drilling on Gjøkåsen included proving oil in the Realgrunnen subgroup and
acquiring sufficient data to evaluate commerciality/need for future exploration wells in the
area.
The well had the following casing profile: 9 7/8-inch pilot hole, 36-inch conductor casing, 20-
inch x 13 5/8-inch surface casing and 9 5/8-inch liner. Plans called for the well to be drilled
with seawater and viscous fluids (pills) in the top hole and 17 ½-inch sections, and with
water-based drilling fluid in the 12 ¼- and 8 ½-inch sections.
Water depth at the well location is 293 metres below MSL, and West Hercules was originally
due to maintain position with the aid of thruster-assisted mooring. When the consent
5
application was submitted, the use of dynamic positioning was under evaluation and this was
the solution finally chosen for the Gjøkåsen location.
1.1 DESCRIPTION OF FACILITY AND ORGANISATION
West Hercules is a sixth-generation GVA 7500 semi-submersible DP drilling facility, built at
DSME in Korea and completed in 2008. An acknowledgement of compliance (AoC) was
issued for it in December 2012. It is owned and operated by Seadrill, with day-to-day
operation handled from Stavanger. Parts of the company’s support organisation for technical
and subsea disciplines are located in Dubai and Houston.
The facility is registered under the Panamanian flag and has DNV GL class certificates. In
recent years, it has been active on both Norwegian and foreign continental shelves. From
October 2016 to April 2018, the rig was laid up in Skipavika. It was reactivated, crewed up
and classed to drill a well for Siccar Point Energy (SPE) on the UK continental shelf in the
spring of 2018. Equinor received consent to use West Hercules for exploration drilling on
Gjøkåsen in July 2018.
Figure 1: The semi-submersible West Hercules drilling facility. (Source: Seadrill)
1.2 STATUS BEFORE THE INCIDENT
Operations in the days before the incident involved batch drilling of the top hole sections on
Gjøkåsen and Gjøkåsen Deep. These wells are about 3.5 kilometres apart. Top hole sections
in a subsea well are drilled without a BOP, which is installed after running and cementing the
20-inch casing. The top hole sections in both wells were drilled and the casing had been
cemented and pressure-tested before the incident occurred.
The incident occurred when the drilling team was running the drill string for the 12 ¼-inch
section through the BOP. The sea was calm with 0.4 metres of heave and good weather.
6
1.3 EQUIPMENT INVOLVED
Plans called for the ADS and the electronic well specific operational guidelines (e-WSOG) to
be installed while the rig was completing the top hole sections.
The ADS is delivered by Future Production A/S (Future). An additional and independent
system installed on a flexible joint (flexjoint), it is meant to send a signal which activates
disconnection of the LMRP if communication between BOP and rig fails. This signal is given
if the flexjoint angle exceeds a predetermined limit, set at six degrees on West Hercules. It
activates the emergency disconnect sequence (EDS).
Figure 2: Example of a subsea BOP and LMRP.
The EDS makes it possible to disconnect the LMRP in cases where a rig with DP is drifting
off location. At the same time, the borehole is secured by closing the BSR. A predefined
sequence causes the LMRP to disconnect from the BOP after the EDS has been activated. The
disconnection sequence takes about 55 seconds.
7
Figure 3: The green circle in the diagram indicates the safe working area and the yellow one shows when the EDS initiates disconnection.
(Source: Journal of Marine Science and Engineering)
The ADS was developed by Smedvig and Future in 2002 at the request of Norsk Hydro on the
Troll field. Seadrill holds the patent for the ADS.
Figure 4: Outline of the ADS disconnect mechanism with all Figure 5: Outline of ADS activation of the disconnect mechanism.
components. (Source: Seadrill) (Source: Seadrill)
Figure 6: The ADS installed on the West Hercules flexjoint. Figure 7: The ADS installed on the West Hercules test bench.
(Source: Seadrill) (Source: Seadrill)
8
An LMRP disconnect signal is sent by the ADS when the angle of the flexjoint exceeds six
degrees. The ADS signal is sent to the EDS, which actually activates the disconnection. The
BSR closes automatically when LMRP disconnection occurs.
The e-WSOG is used for electronic load measurement in order to identify the total effect of
waves and drilling on the wellhead. This information is advantageous for finding the best
operational criteria to prevent fatigue in the steel.
It emerged from the interviews that the level of activity for the subsea personnel had been
high. Installing the ADS and e-WSOG represented extra jobs in addition to normal work done
on the BOP. After they were in place, the BOP and riser were installed on the wellhead and
the connection tested before running in the string to drill the 12 ¼-inch section.
1.4 ABBREVIATIONS AND EXPLANATIONS
ADS Automatic disconnect system
AoC Acknowledgement of compliance from the PSA
BAH Bottom hole assembly
BOP Blowout preventer
BSR Blind shear ram
CCTV Closed circuit television
DAT Direct acting tensioner
DP Dynamic positioning
DSME Daewoo Shipbuilding & Marine Engineering
EDS Emergency disconnect sequence
e-WSOG Electronic well specific operating guidelines
FAT Factory acceptance test
Flexjoint Flexible joint in the riser system
FMECA Failure mode, effects and criticality analysis
Hazop Hazardous operation analysis
GVA Götaverken Arendal – rig designer and builder
HTO Human, technology and organisation
LMRP Lower marine riser package
MOC Management of change
MSL Mean sea level
Primary barrier Casing and cement under the incident
PSA Petroleum Safety Authority Norway
Riser margin Safety margin in the specific gravity of the drilling fluid
ROV Remotely operated vehicle
Secondary barrier BOP
VOR Variation order request
9
2 THE PSA’S INVESTIGATION
The PSA was notified of the incident by Seadrill at 13.50 on 17 January 2019 and decided on
18 January 2019 to initiate its own investigation of the incident.
Composition of the investigation team:
Amir Gergerechi, F-drilling and well technology (investigation leader)
Kristen Kjeldstad, F-drilling and well technology
Eigil Sørensen, F-drilling and well technology
Fredrik Dørum, F-drilling and well technology
Linn Iren Vestly Bergh, F-occupational health and safety
2.1 MANDATE FOR THE INVESTIGATION
The mandate for the investigation was established in accordance with section 4.1.2 in the
PSA’s procedure for investigating incidents.
a. Clarify the incident’s scope and course
b. Assess actual and potential consequences
1. harm caused to people, material assets and the environment
2. the potential of the incident for harming people, material assets and the
environment
c. Assess direct and underlying causes
d. Identify nonconformities and improvement points related to the regulations (and
internal requirements)
e. Discuss and describe possible uncertainties/unclear aspects
f. Discuss barriers which have functioned (in other words, those which have helped to
prevent a hazard from developing into an accident, or which have reduced the
consequences of an accident)
g. Assess the player’s own investigation report
h. Prepare a report and accompanying letter (possibly with proposed use of enforcement
powers) in accordance with the template.
i. Recommend – and normally contribute to – further follow-up by the PSA
j. Assess the relationship between causes and measures related to cost reductions,
efficiency improvements and the level of activity
2.2 LIMITATIONS
The investigation covers clarification of direct and underlying causes until the incident date.
2.3 INTERVIEWS, VERIFICATION ON THE FACILITY AND ASSESSMENT OF
DOCUMENTS
It was decided that the investigation should be conducted on land, without an inspection on
West Hercules.
10
Interviews were conducted with Seadrill, Equinor and Future. A total of 25 people were
interviewed during the investigation.
Technical investigations conducted by Seadrill, Equinor and Future have also been utilised.
In addition, documents were reviewed as part of the investigation.
3 COURSE OF EVENTS
On 16 January 2019, work was underway on running the 12 ¼-inch drill string into the well
during preparations for drilling the 12 ¼-inch section.
The sea was calm with 0.4 metres of heave and good weather.
After running the BHA, the crew began running drill pipe at about 22.00.
An unusual noise heard at 22.51 coincided with a rig movement. Loss of drilling fluid from
the trip tank was then observed.
Figure 8: Activity log and loss of fluid. (Source: Seadrill)
Observation of the riser’s telescopic joint with CCTV from the drill floor showed that the
DAT cylinders were contracted – confirming that the riser was disconnected from the BOP.
The drill string was observed to be stuck, and the heave compensator was therefore connected
to it.
An ROV was launched a few minutes later to observe the condition of the riser and BOP at
the seabed.
11
ROV surveys confirmed that the LMRP was disconnected. The drill string was centred and
stuck in the BOP. Later investigations showed that automatic closure of the BSR had been
activated because of the disconnection
Figure 9: Images taken by ROV after the unintentional disconnection. (Source: Seadrill)
The eight-inch drill collars forming part of the BHA were caught in the BSR when the latter
was automatically activated. These collars cannot be cut and were therefore stuck in the
BOP’s partially closed BSR.
Figure 10: This image of an eight-inch drill collar on deck after the incident shows damage after the
collar was crushed in the BSR. (Source: Seadrill)
The crew on West Hercules and technical specialists on land worked out that the ADS had
activated and caused a disconnection. This followed ROV inspections down on the BOP and a
review of logs from the Cameron BOP control system on board.
12
4 POTENTIAL OF THE INCIDENT
4.1 ACTUAL CONSEQUENCES
The actual consequences of the incident are limited to financial loss. This relates to downtime
in connection with operations and replacing damaged equipment in the BOP.
No personal injury was caused by the incident
The incident did no damage to the environment. The discharge from the riser was seawater.
The BSR in the BOP was damaged and replaced. Other material damage was limited.
4.2 POTENTIAL CONSEQUENCES
When the incident occurred, the well was secured with casing and a cement plug at the
bottom. No danger therefore existed of discharges to the environment from potential reservoir
zones. The ADS was activated at an arbitrary time. Had the same incident occurred later, with
hydrocarbons present in the formation, the position could have been more demanding. The
well would not have been secured, and hydrocarbons could have been discharged from
potential reservoir zones.
The detailed operation plan (DOP) and interviews describe drilling the 12 ¼- and 8 ½-inch
sections without a riser margin. This means no margin was planned for the loss of the
pressure contribution in the well from the fluid column in the riser. In cases with weak
primary barriers and no secondary barriers, as described above, communication could arise
between potential reservoir zones in the 12 ¼- or 8 ½-inch sections and the environment.
Had the incident occurred after the riser was filled with drilling fluid, the latter could have
drained to the sea and caused environmental pollution.
5 DIRECT AND UNDERLYING CAUSES
5.1 DIRECT CAUSES
The direct cause of the incident was a fault in the ADS which sent a signal to disconnect the
LMRP from the BOP.
This disconnect signal derived from an incorrectly installed trigger valve on the ADS.
5.2 UNDERLYING CAUSES
The investigation has identified several underlying causes of the unintended disconnection of
the LMRP. These relate primarily to:
- risk management
- competence and capacity
- procedures and compliance
- management of change (MOC)
13
- see-to-it duty.
5.2.1 RISK MANAGEMENT
Several processes in Seadrill’s management system describe when and how a hazardous
operation analysis (Hazop) is to be conducted. According to the company’s internal
procedures, this must include technical, organisational and operational conditions.
A Hazop was conducted for installing the ADS. The Hazop meeting was held on the facility
about three months before installation. At that time, uncertainty prevailed about the timing of
the installation and about an overview of the ADS equipment. The investigation has found
that the Hazop was not reviewed ahead of the work to be done, and risk associated with the
installation was consequently not communicated to the executing personnel.
Several risk-reducing measures were identified by the Hazop. A number of the risks were
identified as green/checked off as acceptable without systematic verification that the measures
taken had achieved the intended effect. The Hazop refers, for example, to inadequate
procedures which did not contain critical information required for installing the ADS.
Installation of the ADS on West Hercules in 2012 was regarded as a risk-reducing measure
even though several changes had occurred since that earlier occasion. See 5.2.3.
The participant list for the Hazop shows that neither equipment supplier Future nor the
operator took part.
The Hazop did not include uncertainty assessments related to human and organisational
conditions, such as training/experience with the ADS equipment and the significance of the
increased workload.
Interviews and the document review reveal that neither executing nor supervisory personnel
were adequately acquainted with and conscious of the risk associated with installing and using
the ADS.
5.2.2 COMPETENCE AND CAPACITY
Interviews and the governing document review reveal that no training was established for the
ADS. According to PRO-00-0510, Seadrill requires that each facility establishes an
competence matrix and makes provision on board for tailored on-the-job training. Such
training related to the ADS was not included in the West Hercules competence matrix and
none was conducted for ADS equipment.
Knowledge of possible challenges related to machine-machine communication was also
lacking. Nor was the organisation sufficiently aware that the BSR would close when the
LMRP was disconnected from the BOP because of ADS activation, even when the BOP
control system is placed in a mode where it should not close.
14
Interviews and the document review show that employees experienced an increased workload
and inadequate planning of the ADS installation job ahead of the incident. Installing the ADS
was an extra job on top of the work to be done on the BOP. The investigation has found that
the potential risk related to these conditions (scope of work, training) was not identified/
addressed by the Hazop, and that a lack of continuity existed in project execution. The
package owner initially leading and organising the project was not involved in its installation
phase.
The investigation shows that inadequate provision was made for the overall scope of work,
which included installation of extra equipment (ADS and e-WSOG) in addition to ordinary
jobs within the time allocated. Nor was provision made for necessary measures to enhance the
competence of the executing personnel.
Inadequate knowledge of ADS and pressure/scope of work were reinforced by the failure of
the company to make appropriate procedures for ADS available in order to ensure prudent
planning and execution of the work.
5.2.3 PROCEDURES AND COMPLIANCE
Procedures and documentation related to testing, installing and maintaining the ADS are
considered inadequate. Critical measurements for ensuring that the equipment functioned as
intended were not made, for example. No documents describing how to install the system
have been presented.
Interviews and the document review also show that the DIR-00-0034 Risk Analysis procedure
for Hazop was not followed in the Hazop meeting ahead of the ADS installation.
5.2.4 MANAGEMENT OF CHANGE
Interviews and the document review reveal that changes related to ADS installation and the
BOP system in 2012 and 2018 were not followed up. According to the DIR-37-0015 and
PRO-37-0249 procedures, an MOC process must be implemented for changes related to
installation of new equipment or systems.
The ADS was installed by Future for the first time in 2012 on West Hercules and was part of
the BOP system until 2014. A Synergi case (1092560) was created in 2012. The investigation
team found no documentation in the Synergi case concerning the conduct of FMECA and
Hazop analyses or other risk assessments when installing and using the ADS in 2012. A
change request document was also created. This describes such requirements as risk
evaluation and worker participation. These have not been selected as elements in the change
request. The assessments underlying this decision are not described.
In 2014, the ADS was uninstalled and placed in storage before the rig moved to Canada.
15
The decision to reinstall the ADS was taken in 2018, and contained in a variation order
request (VOR) from Equinor to Seadrill dated 28 May 2018. Before work started on
Gjøkåsen, the ADS was taken from storage and recertified by Future. Before the ADS was
dispatched, Future carried out a factory acceptance test (FAT) on 12 October 2018 in the
presence of DNV GL. Future was not on West Hercules when the ADS was installed by
Seadrill personnel. This was not picked up as a change pursuant to the MOC procedure.
Interviews and the document review also reveal documentation missing in the MOC process.
No FMECA analyses were conducted, for example, ahead of installing the ADS.
5.2.5 SEE-TO-IT DUTY
Interviews and the document review reveal inadequate performance of the operator’s see-to-it
duty. The VOR from Equinor covered certification and installation of the ADS, which is
safety-critical equipment. Equinor did not adequately check that Seadrill had the competence
to carry out this type of work itself. Nor did it follow up whether risk assessments were
conducted in relation to installing extra equipment. Equinor thereby failed to satisfy itself that
planning and preparations for installing safety-critical equipment were conducted in a prudent
manner and in accordance with the regulations
5.3 ORGANISATIONAL CHANGES, COST REDUCTIONS AND INCREASED
EMPHASIS ON EFFICIENCY
The investigation team’s mandate required it to assess whether any connection existed
between identified causes and measures related cost reductions, enhanced efficiency and the
level of activity. No absolute connections have been found, but the following have emerged.
• West Hercules’ new drilling contract requires the contractor to perform more work than in
earlier contracts, while the rig rate is relatively low.
• In recent years, Seadrill has undergone several organisational changes both offshore and
on land. West Hercules has been mothballed and the crew laid off. The rig was then
reactivated and crewed up. The head office and technical support have been moved and
reorganised several times, and are now in Dubai and the USA respectively.
• Interviews and the document review show deficiencies in overview and management. The
investigation has revealed, for example, a lack of risk assessments and documentation in
the MOC process. This has clearly had consequences for planning and execution. See 5.2.
• Interviews and the document review reveal that the workload was perceived to be high.
This was also reported/communicated to support personnel on land in Seadrill.
• Despite a lack of competence and experience, Seadrill decided not to involve the
equipment supplier, Future, in installing the ADS.
16
• Projects in Seadrill were previously led/organised/followed up by the package owner, a
qualified person on land who supervised projects. This function was used in the initial
phase of the ADS and e-WSOG projects, but dropped towards the end of these.
• Several conditions also arose during the installation which should have prompted a halt
and a new risk assessment, but this did not happen. Measurements made during
installation on board, for example, failed to accord with results from the FAT. Procedures
were also deficient. These involve measurements which are critically important for the
equipment functioning as intended.
6 OBSERVATIONS
The PSA’s observations fall generally into two categories.
• Nonconformities: observations where a breach of the regulations has been proven.
• Improvement points: observations where inadequacies are seen, but insufficient
information is available to prove a breach of the regulations.
6.1 NONCONFORMITIES
6.1.1 RISK MANAGEMENT
Nonconformity
Deficiencies in risk analyses intended to provide a nuanced and integrated picture of the risk
associated with installing the ADS. Insufficient risk analysis was carried out, nor was an
adequate decision base available before ADS installation.
Grounds
- According to the document review, the Hazop was not reviewed before work started.
- The Hazop participant list shows that the equipment supplier was not present.
- No account was taken in the Hazop of human and organisational conditions, such as
training and experience with the ADS equipment and the significance of an increased
workload.
- Several risk-reducing measures were identified by the Hazop. A number of the risks
are identified as green and accepted without an adequate assessment of the quality of
the measures.
- The document review shows that the Hazop conducted was not signed as approved.
Requirements
Section 17 of the management regulations on risk analyses and emergency preparedness
assessments
Section 11 of the management regulations on the basis for making decisions and decision
criteria
17
6.1.2 COMPETENCE AND CAPACITY
Nonconformity
Personnel with responsibility for planning and executing the installation had limited
competence about the ADS. The work was not adequately organised to reduce the probability
of errors which could lead to hazards and accidents.
Grounds
- It emerged from interviews that personnel given responsibility for installing equipment on
the facility were not provided with the qualifications to do the work:
o personnel involved had not acquired sufficient experience and training with the ADS
o the competence matrix does not include the ADS and no training programme has been
established.
- The investigation has identified a lack of provision for the total scope of work. This
included the installation of extra equipment (ADS and e-WSOG) on top of the ordinary
assignments to be completed within the specified time frame. In addition, necessary
measures for enhancing the competence of executing personnel were not provided.
Requirements
Section 21 of the activities regulations on competence
Section 33 of the activities regulations on organisation of work
6.1.3 PROCEDURES AND COMPLIANCE
Nonconformity
Inadequate procedures and failure to comply with procedures.
Grounds
Documentation for the ADS has several deficiencies, including:
- lack of important measurements related to installation
- no specific procedure for installation
- inadequate procedure for maintenance.
In addition, interviews and the document review reveal that the DIR-00-0034 Risk Analysis
procedure was not observed when conducting a Hazop meeting ahead of ADS installation.
Requirements
Section 24, paragraph 2 of the activities regulations on procedures
Section 23 of the framework regulations on general requirements for material and
information
6.1.4 MAINTENANCE
Nonconformity
Failure to establish routines for follow-up and maintenance of the ADS.
18
Grounds
Interviews and the document review show that no routines were established in the
maintenance management system for conducting and following up maintenance of the ADS.
The ADS was initially adopted on West Hercules in 2012. When the incident occurred, no
routines for the ADS had been established in the maintenance management system. No class
survey was conducted, for example, or criteria established for testing the equipment. The
investigation has found that a possible recertification (class survey) of the equipment every
five years had not been assessed. In addition, documentation on maintenance from the
supplier was deficient. See 6.2.4.
Requirements
Section 47 of the activities regulations on maintenance programme
Section 46 of the activities regulations on classification
6.1.5 MANAGEMENT OF CHANGE
Nonconformity
No MOC was conducted in relation to upgrading the BOP and installing the ADS on West
Hercules. Issues related to health, safety and the environment were not adequately identified
or followed up.
Grounds
The ADS was installed on West Hercules for the first time by Future in 2012 and was part of
the BOP system until 2014. No documentation has been found by the investigation team for
FMECA, Hazop and other risk assessments related to installation of the ADS in 2012 and
2019.
Interviews and the document review reveal that changes related to ADS installation and the
BOP system in 2012 and 2018 were not followed up. According to the DIR-37-0015 and
PRO-37-0249 procedures, an MOC process must be implemented for changes related to
installation of new equipment or systems.
Requirement
Section 11 of the management regulations on basis for making decisions and decision criteria
6.1.6 SEE-TO-IT DUTY
Nonconformity
Failure to exercise see-to-it-duty.
Grounds
Installing the ADS was an Equinor requirement. This was a VOR for work on and with
safety-critical equipment.
19
Equinor failed to follow up whether Seadrill had sufficient competence to reinstall this
equipment itself or whether risk assessments were conducted in relation to installing extra
equipment. The company failed to assure itself that planning and preparations for installing
safety-critical equipment were conducted in a prudent manner and in accordance with the
regulations.
Requirement
Section 7, second paragraph, and section 18 of the framework regulations on responsibilities
pursuant to these regulations and on qualification and follow-up of other participants
respectively
7 BARRIER STATUS
Table 1: Overview of barrier status
8 DISCUSSION OF UNCERTAINTIES
Some uncertainty prevails about the condition of the ADS equipment on its delivery offshore
to West Hercules. This refers to measurements made during installation on board which did
not conform with the FAT results. See the final bullet point in section 6.3
Time Barriers
which have
functioned
Barriers which
have not
functioned
Technical
barrier
element
Organisational
barrier
element
Operational
barrier
element
Factors
affecting
performance
2012 FMECA not
done for first-
time installation
X
2018 Hazop without
participation by
equipment
supplier
X
2019 Casing X
2019 Casing
cement job
X
2019 ADS not
installed by
supplier
X
2019 BOP BSR X
2018-19 See-to-it duty X
2018-19 Measures from
Hazop
X
2019 Procedure for
ADS installation
X
20
9 ASSESSMENT OF THE PLAYER’S INVESTIGATION REPORT
With participation by Equinor, Seadrill investigated the incident and completed its report on 3
April 2019. The report found that the unplanned disconnection of the LMRP was
unintentionally activated by the ADS. The BSR was also automatically activated because it
had not been disarmed.
The PSA team observes that has Seadrill applied probability calculations in its assessments of
the potential of the incident where the BSR failed to seal the well. The probability that the
BSR would be activated against components which cannot be cut is low. However, the
relevant incident shows that such a position could arise. The team therefore takes the view
that the Seadrill report does not describe the full potential of the incident.
Underlying causes relate to the lack of quality control processes in Seadrill, Future and
Equinor. The investigation report describes several specific proposals for further follow-up to
avoid similar incidents recurring.
The PSA team considers that observations in this report largely coincide with the observations
made in the PSA’s investigation report.
10 APPENDICES
A: HTO diagram
B: List of documents utilised in the investigation
C: Overview of personnel interviewed